Hacker News Reader

Comment by milderworkacc | Hacker News Reader

Prepaid single purpose cards like Oyster (and Opal and Myki in Sydney and Melbourne which I’m more familiar with) have a huge advantage in not being linked to your legal name and address in the way your credit card is. Removing that option links every trip on public transport to a legal identity overnight.

We only have these cards due to historical quirk (quick contactless technology existed, but not in credit cards), and if we lose them, it’s another thing that we’re never getting back.

(I protested the removal of paper tickets from Sydney’s trains and busses, for what it’s worth…)

View on HN

It wasn't that long ago, I am certain your comment would have been downvoted on HN.

It wasn't that long ago Google or Apple were Saint. The future is Apple Pay, Cashless, Contactless Credit Card, Crypto.

It wasn't that long ago people that worries about privacy or freedom were over reacting, paranoid, pessimistic.

It wasn't that long ago having physical Cash, topping up your Oyster / Opal / Myki / Suica / Octopus / EZ-Link / Presto or any other Top Up Prepaid Card were dumb. The future is Apple Wallet.

How the tides have turned

I've also observed this. It's great to see, if not a bit late.

If you paid for it with your credit card, then it certainly is linked to your name. And not a lot of people use cash these days

The purchase of credit can be linked for sure. But at least my trips can’t be tracked. I can say, use anyone’s travel card. Anyone can top up my card. I can top up with cash. Whatever. Each individual trip can’t be tied to a person.

We don’t want to lose this privacy because as mentioned. We’ll never get it back.

> But at least my trips can’t be tracked.

Sorry to break it to you but I'm pretty sure that unless you're actively swapping Oyster cards with random strangers, the pattern of metadata of where and when that card enters and exits the Underground or Overground, or when it takes a bus ride (and the route number at least) can soon yield a useful collection of data points (which in turn can be cross-referenced with CCTV timestamps) for any "authority" that's interested in tracking you.

It’s still nice for people who may not have (local) bank accounts, namely poor people and tourists.

IIRC you can’t have a WeChat pay account without a Chinese bank account.

Most tourists should find their contactless card or equivalent (e.g an iPhone) just works. There may be a brief extra pause, especially the very first time you touch a gate, as the system figures out that yes this is a payment card, and yes it can afford to pay for a journey on the network. So, probably don't choose peak time at a crowded station to find out if your card or phone works.

I would much prefer if this was true for most public transit networks in the world, including the rest of the UK.

Many banks charge a hefty premium for overseas purchases, and they tend to charge per purchase.

TfL settles every 24 hours, so you'll only have a single purchase per 24H regardless of how many journeys you've taken.

I'd also argue that in this case the fault is on the cardholder for being with a shit bank when better options exist in the vast majority of countries.

I think that's an absurd requirement to levy on tourists and oyster cards are a perfectly reasonable solution.

That would be most American banks.

The US does not have contactless credit cards. Britain has a financial and national security interest in American tourists — who will need oyster cards.

Wait, what? All my US cards except for the metal amexes have been contactless for years. All of them also support apple pay.

I have 2 Mastercards and 1 Visa. Only one of the Mastercards support contactless. The one without foreign transaction fees doesn't. It's also been vary hard to find a chip+pin card (without an annual fee) instead of a chip+signature even though it's been around for what, 20 years now?

In general even if the card isn't contactless, a decent phone, which can perform contactless transactions, can be hooked to the same account anyway.

In fact I deliberately own a non-contactless credit card (from my good bank, who were happy to send me the non-contactless version when requested even though their default is contactless) and then enrolled that card in my phone so the phone can make contactless purchases.

Thus, my credit card can't be hijacked to do remote purchases because purchases with the card require a physical connection, and yet I can make fairly large card purchases contactlessly, because my phone vouches for them after I unlock it.

That is true, but even with a US card in the US, there are vague scenarios where ApplePay requires a signature[1]. So it's problematic using it for unmanned terminals when traveling. I've had trouble traveling internationally and wouldn't trust it taking mass transit without extra time or a backup option.

[1] https://www.macobserver.com/tmo/article/when-apple-pay-requi...

Obviously TfL can't do anything about a US bank/ card issuer having policies that lose them money, but the turnstiles are aware that they have no (passenger accessible) inputs and so they do not ask for a signature.

EMV lets the card (or in this case maybe a phone) and the terminal (in this case a turnstile inside the station, or a reader on a bus) negotiate what to do, the issuer may not be involved since it's possible they'll agree the entire transaction needn't yet involve the issuer. This is related to one bug in EMV, you could intercede in the middle to tell the card "It's OK, no need for a PIN" and also tell the terminal, "Yes, the PIN supplied was correct" and since the terminal doesn't know the correct PIN you've now got a shim that allows you to use the wrong PIN with a stolen card†.

Anyway, TfL terminals aren't going to agree to signatures. So, if your card really does only work with a signature then you can't use the turnstiles, along with presumably many other modern conveniences.

† There are obvious technical fixes. But the fixes cost money, and fraud is a cost banks can pass to their customers, guess what happens next.

That is false. The US absolutely does have contactless credit cards.

I'm from the US and haven't had great luck in Europe. One card ditched "travel alerts" in 2016, the other I swore added one when it saw I purchased plane tickets, but it didn't. Both got flagged causing problems. One card I specifically got because it had no foreign transaction fees and was recommended for traveling. Only one of my cards is contactless and I about every 4th or 5th transaction I get flagged and they need to enter info from my ID to complete the transaction. For a lot of services that require preauthorization just don't work and don't give clear error messages.

Even if my card worked the first time I wouldn't trust it would work the 3rd or 4th. Until I bought a monthly pass every trip took time and some luck. I wish I knew prepaid cards were an option.

You can fill an anonymously purchased Oyster with actual coins at select locations. I used to fill mine with otherwise useless small change periodically. In this way the Oyster is not tied to a credit card, although of course TFL does have CCTV so if they really wanted to (e.g. you murder somebody and leave the card at the scene) they could trawl through the CCTV footage matching the times the card was used.

My Oyster is anonymous (ish, apart from surveillance). I only ever topped it up with cash.

With credit card payment, facial recognition, cell phone GPS tracking, etc. I think they can connect you to the trip even if you used Oyster. And if they're taking photographs of the currency that ATM machines are spitting out (easily possible) there's nothing to suggest that they can't track cash transactions as well.

My thinking has always been that yes, targeted surveillance of a target in public is easy, but is it “every trip in a searchable database” easy? Facial recognition is the one here that actually does make it that easy, hence my strong opposition to it!

With enough effort, anything is possible. When it comes to hiding from authorities (or anyone, really), it's only a matter of putting up more roadblocks than they're willing to overcome.

They're human, too. Often dumb, most often uninterested and lazy. And everyone gives up at some point.

Privacy does have a cost. I was working at TfNSW at the time they were phasing out the paper tickets and the main reason they got rid of them was the enormous cost of having and maintaining all that paper ticket infrastructure. I think it was basically going to cost alot more to have the ticket infrastructure than the revenue gained back from the actual tickets due to the very small number of people still using the paper tickets.

In fact most of the decisions around ticketing were more about reducing costs and improving efficiency than reducing privacy (that was just the side effect) for example on buses people paying with cash were massively slowing down the boarding in busy areas, so they made pre-pay or opal only buses during peak hours hours in some areas to improve the on time running. Bus drivers also hated dealing with change and carrying money as well. They were already trying to phase out the use of cash on buses and I think covid accelerated that trend as they now had a great excuse to do so everywhere.

In fact even a few years ago there was already discussion of using CCTV and facial recognition to track people through stations and what they use, the idea being you could then pay for your trip the same way those Amazon supermarkets work as that would reduce the congestion at gates and allow better tracking of full trips as Opal data can't determine your exact route, only the parts where you tapped.

The reality is most people will complain far more about having to pay slightly higher ticket costs than for the loss of privacy, so it's a fairly easy decision for politicians to make and why Australia has so many sweeping surveillance powers.

Will my old identity building knowhow be useful in this brave new world? Only one way to find out!

Reply on news.ycombinator.com